> Why did they think this was a cyberattack and only after two hours realize it was the config file?

They explain that at some length in TFA.